What is GHSA-x23m-8c2h-6wg7?

GHSA-x23m-8c2h-6wg7 is a security advisory published by GitHub Security Advisories with Medium severity. Redgate SQL Change Automation Plugin stored credentials in plain text

Which CVE IDs does GHSA-x23m-8c2h-6wg7 cover?

GHSA-x23m-8c2h-6wg7 covers the following CVE IDs: CVE-2020-2095. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x23m-8c2h-6wg7?

GHSA-x23m-8c2h-6wg7 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-x23m-8c2h-6wg7?

GHSA-x23m-8c2h-6wg7 affects 1 product, including: maven/com.redgate.plugins.redgatesqlci:redgate-sql-ci:\u003c 2.0.5.

GHSA-x23m-8c2h-6wg7MediumCVSS 4.3

Redgate SQL Change Automation Plugin stored credentials in plain text

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 21, 2023

🔗 CVE IDs covered (1)

CVE-2020-2095 →

📋 Description

Redgate SQL Change Automation Plugin 2.0.4 and earlier stores a NuGet API key unencrypted in job config.xml files as part of its configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

This is due to an incomplete fix of SECURITY-1598.

Redgate SQL Change Automation Plugin 2.0.5 now stores the API key encrypted. Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten.

🎯 Affected products1

maven/com.redgate.plugins.redgatesqlci:redgate-sql-ci:< 2.0.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-2095
https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1696
https://github.com/jenkinsci/redgate-sql-ci-plugin/commit/962f1770eeb1f18dfac91d12461fa6db566e769e
https://github.com/advisories/GHSA-x23m-8c2h-6wg7